feat(runner/triggers): attach Critical insight to service_no_endpoints evidence

The investigate page renders per-block insights; the collector's only
sources are Warning rows in event tables (a zero-endpoint Service emits
no K8s events) and pod-status extraction from the raw-event json (the
subject is a Service), so these findings surfaced with an empty
Insights section. Ship the insight explicitly via additional_info
.insights, which the collector passes through verbatim.

Author: mayankpande88

runner/pkg/triggers/service_endpoints.go

@@ -107,13 +107,31 @@ func serviceNoEndpointsEnrichBlocks(obj, _ map[string]any, ec EnrichContext) []E
 	}
 	sel := serviceSelector(obj)
 	ns := metaNS(obj)
+	condition := fmt.Sprintf(
+		"No pods and no workload pod templates in namespace `%s` match this selector. "+
+			"The Service has no endpoints and cannot route traffic — requests to it fail "+
+			"even though the Service object itself looks healthy.", ns)
 	blocks := []EvidenceBlock{
 		headerBlock(fmt.Sprintf("Service %s has no matching endpoints", metaName(obj))),
 		markdownBlock(fmt.Sprintf("*Configured selector:* `%s`", formatSelector(sel))),
-		markdownBlock(fmt.Sprintf(
-			"No pods and no workload pod templates in namespace `%s` match this selector. "+
-				"The Service has no endpoints and cannot route traffic — requests to it fail "+
-				"even though the Service object itself looks healthy.", ns)),
+		// The collector passes additional_info.insights through to the
+		// Finding's per-block insight list, which is what the investigate
+		// page renders as Insights. Without this the page shows nothing:
+		// its other insight sources are Warning rows in event tables (a
+		// zero-endpoint Service emits no K8s events) and pod-status
+		// extraction from the raw-event json (subject is a Service).
+		{
+			"type": "markdown",
+			"data": condition,
+			"additional_info": map[string]any{
+				"insights": []map[string]any{{
+					"message": fmt.Sprintf(
+						"Service %s/%s selector (%s) matches no pods and no workload pod templates — traffic to the Service is failing",
+						ns, metaName(obj), formatSelector(sel)),
+					"severity": "Critical",
+				}},
+			},
+		},
 	}
 	return append(blocks, podLabelComparisonTable(ec, ns)...)
 }

runner/pkg/triggers/service_endpoints_test.go

@@ -149,6 +149,26 @@ func TestServiceNoEndpoints_EnrichBlocks(t *testing.T) {
 		t.Error("evidence must include the pod-labels comparison table")
 	}
 
+	// One block must carry additional_info.insights with severity Critical
+	// — the collector passes it through to the Finding's insight list,
+	// which is what the investigate page renders.
+	haveInsight := false
+	for _, b := range blocks {
+		ai, _ := b["additional_info"].(map[string]any)
+		if ai == nil {
+			continue
+		}
+		ins, _ := ai["insights"].([]map[string]any)
+		for _, i := range ins {
+			if i["severity"] == "Critical" {
+				haveInsight = true
+			}
+		}
+	}
+	if !haveInsight {
+		t.Error("evidence must carry a Critical insight via additional_info.insights")
+	}
+
 	// Empty namespace → the table degrades to a "no pods at all" note.
 	ec = EnrichContext{ServiceBackends: &fakeServiceBackends{}}
 	blocks = serviceNoEndpointsEnrichBlocks(brokenService(t), nil, ec)